DNS SRV record server delegation doesn't work when following the documentation

[bessw]

DNS SRV record server delegation doesn't work when following the documentation

1. The route name for the federation api has changed

# To serve the federation from any domain, as long as the path matches
matrix_synapse_container_labels_public_federation_api_traefik_rule: PathPrefix(`/_matrix/federation`)

# To let Traefik know which domains' certificates to serve
matrix_synapse_container_labels_additional_labels: |
  traefik.http.routers.matrix-synapse-federation-api.tls.domains.main="example.com"
  traefik.http.routers.matrix-synapse-federation-api.tls.domains.sans="*.example.com"

the router labels should now have public in their name: traefik.http.routers.matrix-synapse-public-federation-api.rule

2. Unfortunately the federation tester still complains that it received a 404 response when I fix the above mentioned labels.

my solution

Disclaimer: I don't know if it is the best solution, but feel free to add it to the documentation if you want to

Instead of the changes mentioned the documentation I had to set the following variable to get it working (and configure a way to get my base domain certificate):

matrix_synapse_container_labels_public_federation_api_traefik_hostname: "{{ matrix_domain }}"

(optional bonus info) getting the base domain certificate from a existing externally running acme script

1. configure the acme script to put the certificate and key into matrix/traefik/ssl/mydomain.tld/
2. configure the playbook to use the certificate:

# Tell Traefik to load our custom configuration file (certificates.yml).
# The file is created below, in `aux_file_definitions`.
# The `/config/..` path is an in-container path, not a path on the host (like `/traefik/config`). Do not change it!
devture_traefik_configuration_extension_yaml: |
  providers:
    file:
      filename: /config/certificates.yml
      watch: true

# Use the Auxiliary file role to create our custom files on the server.
aux_file_definitions:
  # Create the custom Traefik configuration.
  # The `/ssl/..` paths below are in-container paths, only adjust `mydomain.tld` to your domain
  - dest: "{{ devture_traefik_config_dir_path }}/certificates.yml"
    content: |
      tls:
        certificates:
          - certFile: /ssl/mydomain.tld/fullchain.pem
            keyFile: /ssl/mydomain.tld/privkey.pem
        stores:
          default:
            defaultCertificate:
              certFile: /ssl/mydomain.tld/fullchain.pem
              keyFile: /ssl/mydomain.tld/privkey.pem

Matrix Server:

• OS: Debian 11.8
• Architecture amd64
• Playbook version: 9dd3326